Sigstore Project Update - Nov 2024

[haydentherapper]

As requested, I'm posting an async update for the TAC for the Sigstore project.

Our second SigstoreCon: Supply Chain Day conference just wrapped up. With just over 90 attendees, SigstoreCon brought together individuals and organizations excited about not only Sigstore but other supply chain initiatives such as SLSA, SBOM, or in-toto. Talks are recorded here.

Last year, we saw the first major adoption of Sigstore with npm leveraging Sigstore for signed provenance. This year saw a rapid increase of adoption of Sigstore, with:

• PyPI's implementation of PEP 740, signed attestations for releases done through trusted publishing. Note that this pattern of leveraging trusted publishing workflows to drive adoption of signed builds and attestations is a pattern we'd like to see repeated across packaging ecosystems.
• Maven Central supporting uploading and verifying Sigstore signatures in addition to PGP signatures
• GitHub Artifact Attestations, producing Sigstore-signed SLSA attestations for CI workflows
• Homebrew's beta release of Sigstore-signed provenance, built on top of GitHub Artifact Attestations.

The client libraries for Sigstore saw active development under the Sigstore clients SIG:

• The first major release of sigstore-java, along with Maven and Gradle plugins
• A v3 release of sigstore-python and sigstore-js
• A beta release of sigstore-go, and we're working towards a 1.0 release and integrating sigstore-go into Cosign
• A release of sigstore-ruby

This development was sped up due to the conformance test suite to verify clients are producing and consuming the same content. We began work to make Cosign conformant, producing standardized "bundles" which contain verification metadata, along with consuming a "trust root" on verification to simplify and improve the verification process. Work will continue into next year to simplify Cosign's UX, add bundle support for signed OCI, and reduce code duplication between Cosign and sigstore-go.

Supported by the public good operations SIG and a multi-vendor oncall rotation staffed by Chainguard, GitHub, Google, Red Hat, and Stacklok, the public-good instance maintained its 99.5% availability SLO throughout the year, handling the increased load from additional adoption without issue.

Sigstore also requested TI funding to help modernize the documentation. This work is underway, with an increased focus on the additional clients and a restructuring of documentation. Into the coming year, we'll add more documentation on generating signatures on and verifying signatures from CI.

Looking forward to next year, we'll see continued adoption of Sigstore. RubyGems has approved an RFC for Sigstore bundles, with development underway. OS package registries like Debian have expressed interest, sparked by discussions with the Python community around deprecating PGP-signed cpython releases in favor of Sigstore-signed releases (PEP 761). Bazel Central Registry has also proposed supporting Sigstore-signed SLSA attestations.

For the long-term sustainability of the Sigstore ecosystem, we will be focusing on driving down the operational cost of our transparency log Rekor. Building on recent developments in the Certificate Transparency ecosystem, we will be redesigning Rekor to be backed by a "tile-based" log, which is cheaper and easier to manage. We've created a proposal to summarize what we will be doing, with implementation and rollout in the next year. We will also look to onboard additional log operators once the operational costs are cheaper.

We'll continue to update the community roadmap as we make progress on these various projects.

[steiza]

Hey @haydentherapper, thanks for providing this update. Could you create a pull request to add this update to https://github.com/ossf/tac/tree/main/TI-reports?